Privacy and Cookie Policy – stringer-s.com

Effective date: 21 July 2026

1. General information

1. This Privacy Policy sets out the rules for processing personal data and using cookies on the website stringer-s.com, including the String Art Generator tool (stringer-s.com/string-art-generator) – the "Service".
2. The controller of personal data is Adrian Duński, conducting business activity under the name Adrian Duński Stringer-s, Tax ID (NIP): 8993038318, Business Registry No. (REGON): 542958410, registered in the Polish Central Registration and Information on Business (CEIDG), where the registration data, including the address, is available (the "Controller").
3. Contact regarding personal data matters: contact@stringer-s.com.
4. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Polish data protection law.
5. The Controller applies the principle of data minimisation – collecting only the data necessary to provide the services. Use of the Service is free of charge, and Users' data is not sold or used for the marketing purposes of third parties.

2. What data we process, for what purpose and for how long

2.1. User Account

• Data scope: e-mail address and password (stored only in encrypted form – a hash); in the case of Google sign-in – data made available by Google: e-mail address, first and last name, and profile picture (if any).
• Purpose: creating and maintaining the Account, enabling projects to be saved, and Account-related communication.
• Legal basis: Article 6(1)(b) GDPR (necessity for the performance of the agreement for the provision of services by electronic means).
• Retention period: until the Account is deleted by the User or the Controller, and thereafter – only to the extent and for the period necessary to establish, pursue or defend claims (Article 6(1)(f) GDPR).

2.2. Photos uploaded to the Generator

• Data scope: an image file uploaded by the User; the photo may contain personal data, in particular a person's likeness.
• Purpose: solely the automatic generation of a string art project at the User's request.
• Legal basis: Article 6(1)(b) GDPR (performance of a service initiated by the User).
• Retention period: if the User does not save the project to the Account – the photo is processed only for the time needed to generate the project and is deleted immediately after processing is complete. If a logged-in User saves the project to the Account – the source photo is stored together with the project until the project or the Account is deleted (see section 2.3). Photos are not used for any other purpose (including training algorithms) and are not shared with third parties.
• Important: processing the photo is fully automatic and technical – the Controller does not identify the persons visible in the photos, does not use facial recognition, and does not process biometric data within the meaning of Article 9 GDPR. A User uploading a photo containing the likeness of third parties should have their consent or another basis for its use.

2.3. Projects saved to the Account

• Data scope: the data of the generated string art project (the sequence of points and connections) and the source photo from which the project was generated – saved by a logged-in User. The data is stored in the Service's database within Google's infrastructure (Firebase).
• Purpose: enabling the User to return to their saved projects.
• Legal basis: Article 6(1)(b) GDPR.
• Retention period: until the project is deleted by the User or the Account is deleted.

2.4. Contact form and e-mail correspondence

• Data scope: e-mail address, first name (if provided), the content of the message and any attachments (including photos) sent by the User.
• Purpose: handling the enquiry and conducting correspondence.
• Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest in handling correspondence), and to the extent aimed at concluding an agreement – Article 6(1)(b) GDPR.
• Retention period: for the time necessary to handle the matter, and thereafter for 12 months or until the applicable limitation periods for potential claims expire.

2.5. Server logs and technical data

• Data scope: IP address, date and time of the request, URL, information about the browser and operating system.
• Purpose: ensuring the security and correct operation of the Service, diagnosing errors, and preventing abuse.
• Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest).
• Retention period: up to 90 days from being recorded.

2.6. Service usage statistics (Google Analytics 4)

• Data scope: data on how the Service is used (pages visited, visit duration, approximate location, device type), collected via cookies and online identifiers. This data is statistical in nature and is not used to identify specific individuals.
• Purpose: analysing traffic and improving the Service.
• Legal basis: Article 6(1)(a) GDPR – consent given by accepting analytics cookies (consent may be withdrawn at any time).
• Retention period: in accordance with the Google Analytics retention settings – 14 months.

3. Recipients of the data

Personal data may be entrusted only to entities that provide technical support to the Controller in delivering the services, under data processing agreements:

1. Google Cloud / Firebase (Google Cloud EMEA Ltd. / Google LLC) – hosting of the Service and server infrastructure (Google App Engine) as well as the database in which Account data and saved projects, together with their source photos, are stored (Firebase); the data is processed in data centres located within the European Union;
2. Google (Google Ireland Ltd.) – e-mail service (Google Workspace), the "Sign in with Google" service, and Google Analytics 4;
3. entities authorised to obtain data under applicable law (e.g. courts, public authorities) – only to the extent required by law.

Data is not sold or shared with other entities for marketing purposes.

4. Transfers of data outside the European Economic Area

Data is, as a rule, processed within the European Union. In connection with the use of Google's services, it is possible that some data (e.g. analytics data) may occasionally be transferred to countries outside the EEA, including the USA. The basis for such a transfer is a European Commission adequacy decision (the EU–US Data Privacy Framework, of which Google LLC is a participant) and standard contractual clauses (SCC). More information: privacy.google.com/businesses.

5. User rights

Every User has the right to:

1. access their data and obtain a copy of it (Article 15 GDPR);
2. rectification of their data (Article 16 GDPR);
3. erasure of their data – the "right to be forgotten" (Article 17 GDPR), including by deleting the Account themselves;
4. restriction of processing (Article 18 GDPR);
5. data portability (Article 20 GDPR);
6. object to processing based on legitimate interest (Article 21 GDPR);
7. withdraw consent at any time – without affecting the lawfulness of processing carried out before its withdrawal;
8. lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise these rights, please contact the Controller: contact@stringer-s.com. The Controller responds without undue delay, and no later than within one month of receiving the request.

6. Voluntary nature of providing data

Providing data is voluntary but necessary to use certain features of the Service (e.g. an e-mail address – to create an Account; uploading a photo – to generate a project). Browsing the Service and using the Generator without saving projects does not require creating an Account.

7. Automated decision-making and profiling

Processing of photos in the Generator is carried out automatically; however, the Controller does not make decisions about Users based solely on automated processing that would produce legal effects or similarly significantly affect them (Article 22 GDPR). The Controller does not profile Users.

8. Data security

The Controller applies technical and organisational measures appropriate to the risk, in particular:

• encryption of data transmission (HTTPS/TLS);
• storing passwords only in encrypted form (a hash);
• hosting within the Google Cloud infrastructure in an EU region, with enterprise-grade safeguards;
• automatic deletion of photos after processing is complete (where the project has not been saved to the Account);
• restricting access to the data to authorised persons only.

9. Cookies

1. The Service uses cookies – small text files stored on the User's device.

2. The Service uses the following categories of cookies:

   a) Essential cookies (basis: the Controller's legitimate interest / necessity to provide the service – no consent required):

   • maintaining the session and authenticating a logged-in User,
   • remembering settings (e.g. the chosen language),
   • remembering the cookie consent decision.

   b) Analytics cookies (basis: the User's consent):

   • Google Analytics 4 files (including _ga, _ga_*) – used to analyse traffic statistics in the Service.

3. Analytics cookies are installed only after the User has given consent in the cookie banner. Consent may be withdrawn or its scope changed at any time via the "Cookie settings" link in the footer of the Service.

4. The User may also manage cookies independently in their browser settings, including blocking or deleting them. Blocking essential cookies may prevent the use of certain features of the Service (e.g. logging in).

10. Changes to the Privacy Policy

1. The Controller may update this Policy, in particular in the event of changes in the law, technological changes, or changes to the Service's features.
2. The current version of the Policy is always available in the Service. Account holders will be informed of any significant changes by e-mail or via a notice in the Service.
3. This Policy applies from 21 July 2026.